CVE-2025-47706

The Enterprise MFA - TFA for Drupal module is vulnerable to an Authentication Bypass by Capture-replay (CWE-294). The root cause is that the module fails to sufficiently verify whether a TOTP token has already been used for authenticator-based second-factor methods. This allows remote services to...

CVE-2025-47706 Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052

Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.3 Bug Fix Update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.18.3 on Red Hat Enterprise Linux 9 from Red Hat Container Registry. Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation...

CVE-2025-3833

Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports...

CVE-2025-3833 SQL Injection

Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports...

Privacy-Preserving Runtime Verification

Runtime verification offers scalable solutions to improve the safety and reliability of systems. However, systems that require verification or monitoring by a third party to ensure compliance with a specification might contain sensitive information, causing privacy concerns when usual runtime...

Drupal Enterprise MFA – TFA for Drupal security vulnerabilities

Drupal Enterprise MFA - TFA for Drupal is a module plugin in the Drupal content management system for the Drupal community. A security vulnerability exists in Drupal Enterprise MFA - TFA for Drupal versions prior to 5.2.0, which stems from the use of an alternate path or channel to bypass...

Drupal Enterprise MFA – TFA for Drupal security vulnerabilities

Drupal Enterprise MFA - TFA for Drupal is a module plugin in the Drupal content management system for the Drupal community. A security vulnerability exists in Drupal Enterprise MFA - TFA for Drupal versions prior to 5.2.0, which stems from a lack of authorization and may result in forced browsing...

VMware Avi Load Balancer Privilege Escalation

The vulnerability of the software for managing traffic in hybrid and multi-cloud environments in VMware Avi Load Balancer is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker to increase their privileges and gain access to create, modify, or delete...

Multi-Vendor BIOS Security Vulnerabilities (May 2025 - Lenovo Support US

No description provided...

kernel: drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()

In the Linux kernel, the following vulnerability has been resolved: drm/dpmst: Ensure mstprimary pointer is valid in drmdpmsthandleupreq While receiving an MST up request message from one thread in drmdpmsthandleupreq, the MST topology could be removed from another thread via...

Remote Code Execution (RCE)

vllm is vulnerable to Remote Code Execution RCE. The vulnerability is due to the use of Python’s pickle module on untrusted data received over a ZeroMQ SUB socket in multi-node deployments using the V0 engine, which allows an attacker to execute arbitrary code on the target machine and potentiall...

SAFE-SiP: Secure Authentication Framework for System-In-Package Using Multi-Party Computation

The emergence of chiplet-based heterogeneous integration is transforming the semiconductor, AI, and high-performance computing industries by enabling modular designs and improved scalability. However, assembling chiplets from multiple vendors after fabrication introduces a complex supply chain th...

CVE-2025-46802

creationtimestamp| type| source ---|---|--- 2025-05-12 17:00:00+00:00| seen| https://security.opensuse.org/2025/05/12/screen-security-issues.html3b-tty-hijacking-while-attaching-to-a-multi-user-session-cve-2025-46802 2025-05-13 11:28:49+00:00| seen| https://news.ycombinator.com/item?id=43971716...

CVE-2025-46803

creationtimestamp| type| source ---|---|--- 2025-05-12 17:00:00+00:00| seen| https://security.opensuse.org/2025/05/12/screen-security-issues.html3b-tty-hijacking-while-attaching-to-a-multi-user-session-cve-2025-46802 2025-05-13 16:45:54+00:00| seen| https://t.me/proxybar/2615 2025-05-14...

LLM-Text Watermarking Based on Lagrange Interpolation

The rapid advancement of LLMs Large Language Models has established them as a foundational technology for many AI and ML-powered human computer interactions. A critical challenge in this context is the attribution of LLM-generated text -- either to the specific language model that produced it or ...

ThreatLens: LLM-Guided Threat Modeling and Test Plan Generation for Hardware Security Verification

Current hardware security verification processes predominantly rely on manual threat modeling and test plan generation, which are labor-intensive, error-prone, and struggle to scale with increasing design complexity and evolving attack methodologies. To address these challenges, we propose...

Enhancing Noisy Functional Encryption for Privacy-Preserving Machine Learning

Functional encryption FE has recently attracted interest in privacy-preserving machine learning PPML for its unique ability to compute specific functions on encrypted data. A related line of work focuses on noisy FE, which ensures differential privacy in the output while keeping the data encrypte...

CVE-2024-13793 Wolmart | Multi-Vendor Marketplace WooCommerce Theme <= 1.8.11 - Unauthenticated Arbitrary Shortcode Execution in wolmart_loadmore

The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.8.11. This is due to the software allowing users to execute an action that does not properly validate a value before running...

QUIC-Exfil: Exploiting QUIC'S Server Preferred Address Feature to Perform Data Exfiltration Attacks

The QUIC protocol is now widely adopted by major tech companies and accounts for a significant fraction of today's Internet traffic. QUIC's multiplexing capabilities, encrypted headers, dynamic IP address changes, and encrypted parameter negotiations make the protocol not only more efficient,...